<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      Chunk Extend and Overlapping 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        Chunk Extend and Overlapping
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-03-22
      </span>

                                                                        <span class="post-pubtime"> 本文共2.8k字 </span>

                                                                        <span class="post-pubtime">
        大约需要22min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<h1 id="Chunk-Extend-and-Overlapping"><a href="#Chunk-Extend-and-Overlapping" class="headerlink" title="Chunk Extend and Overlapping"></a>Chunk Extend and Overlapping</h1><h2 id="介绍"><a href="#介绍" class="headerlink" title="介绍"></a>介绍</h2><p>chunk extend 是堆漏洞的一种常见利用手法，通过extend可以实现chunk overlapping（块重叠）的效果。这种利用的方法需要以下的条件：</p>
<ul>
<li>程序中存在堆的漏洞</li>
<li>漏洞可以控制chunk header中的数据</li>
</ul>
<h2 id="原理"><a href="#原理" class="headerlink" title="原理"></a>原理</h2><p>这种利用的技术能够产生在于ptmalloc在对堆chunk进行操作时使用的各种宏。</p>
<p>在ptmalloc中，获取chunk块大小的宏：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/* Get size, ignoring use bits */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> chunksize(p) (chunksize_nomask(p) &amp; ~(SIZE_BITS))</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Like chunksize, but do not mask SIZE_BITS.  */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> chunksize_nomask(p) ((p)-&gt;mchunk_size)</span></span><br></pre></td></tr></table></figure>

<p>一种是直接获取，不忽略掩码部分，另外一种是忽略掩码部分。</p>
<p>在 ptmalloc 中，获取下一 chunk 块地址的宏：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/* Ptr to next physical malloc_chunk. */</span> </span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> next_chunk(p) ((mchunkptr)(((char *) (p)) + chunksize(p)))</span></span><br></pre></td></tr></table></figure>



<p>在 ptmalloc 中，获取前一个 chunk 信息的宏：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/* Size of the chunk below P.  Only valid if prev_inuse (P).  */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> prev_size(p) ((p)-&gt;mchunk_prev_size)</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Ptr to previous physical malloc_chunk.  Only valid if prev_inuse (P).  */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> prev_chunk(p) ((mchunkptr)(((char *) (p)) - prev_size(p)))</span></span><br></pre></td></tr></table></figure>

<p>在 ptmalloc 中，判断当前 chunk 是否是 use 状态的宏：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">define</span> inuse(p)</span></span><br><span class="line">    ((((mchunkptr)(((<span class="keyword">char</span> *) (p)) + chunksize(p)))-&gt;mchunk_size) &amp; PREV_INUSE)</span><br></pre></td></tr></table></figure>

<p>chunk extend 就是通过控制 size 、prev_size 、prev_inuse域来实现跨越块操作从而导致 overlapping 的。</p>
<h2 id="基本示例"><a href="#基本示例" class="headerlink" title="基本示例"></a>基本示例</h2><h3 id="示例1：对inuse的fastbin进行extend"><a href="#示例1：对inuse的fastbin进行extend" class="headerlink" title="示例1：对inuse的fastbin进行extend"></a>示例1：对inuse的fastbin进行extend</h3><p>示例代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">void</span> *p, *q;</span><br><span class="line">    p = <span class="built_in">malloc</span>(<span class="number">0x10</span>);<span class="comment">//分配第一个0x10的chunk</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>);<span class="comment">//分配第二个0x10的chunk</span></span><br><span class="line">    *(<span class="keyword">long</span> <span class="keyword">long</span> *)((<span class="keyword">long</span> <span class="keyword">long</span>)p - <span class="number">0x8</span>) = <span class="number">0x41</span>;<span class="comment">// 修改第一个块的size域</span></span><br><span class="line">    <span class="built_in">free</span>(p);</span><br><span class="line">    q = <span class="built_in">malloc</span>(<span class="number">0x30</span>);<span class="comment">// 实现extend，控制了第二个块的内容</span></span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这里编译的时候使用了<code>-g</code>参数，可以在gdb调试的时候在任意行下断点。方法：b + 行号</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; n</span><br><span class="line">8	    malloc(0x10);//分配第二个0x10的chunk</span><br><span class="line">LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA</span><br><span class="line">─────────────────────────────────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────────────────────────────────</span><br><span class="line"> RAX  0x602010 ◂— 0x0</span><br><span class="line"> RBX  0x0</span><br><span class="line"> RCX  0x7ffff7dd1b20 (main_arena) ◂— 0x100000000</span><br><span class="line"> RDX  0x602010 ◂— 0x0</span><br><span class="line"> RDI  0x7ffff7dd1b20 (main_arena) ◂— 0x100000000</span><br><span class="line"> RSI  0x602020 ◂— 0x0</span><br><span class="line"> R8   0x602000 ◂— 0x0</span><br><span class="line"> R9   0xd</span><br><span class="line"> R10  0x7ffff7dd1b78 (main_arena+88) —▸ 0x602020 ◂— 0x0</span><br><span class="line"> R11  0x0</span><br><span class="line"> R12  0x400470 (_start) ◂— xor    ebp, ebp</span><br><span class="line"> R13  0x7fffffffdf90 ◂— 0x1</span><br><span class="line"> R14  0x0</span><br><span class="line"> R15  0x0</span><br><span class="line"> RBP  0x7fffffffdeb0 —▸ 0x4005c0 (__libc_csu_init) ◂— push   r15</span><br><span class="line"> RSP  0x7fffffffdea0 —▸ 0x602010 ◂— 0x0</span><br><span class="line"> RIP  0x40057c (main+22) ◂— mov    edi, 0x10</span><br><span class="line">──────────────────────────────────────────────────────────────────────────[ DISASM ]───────────────────────────────────────────────────────────────────────────</span><br><span class="line">   0x40056e &lt;main+8&gt;     mov    edi, 0x10</span><br><span class="line">   0x400573 &lt;main+13&gt;    call   malloc@plt &lt;0x400450&gt;</span><br><span class="line"> </span><br><span class="line">   0x400578 &lt;main+18&gt;    mov    qword ptr [rbp - 0x10], rax</span><br><span class="line"> ► 0x40057c &lt;main+22&gt;    mov    edi, 0x10</span><br><span class="line">   0x400581 &lt;main+27&gt;    call   malloc@plt &lt;0x400450&gt;</span><br><span class="line"> </span><br><span class="line">   0x400586 &lt;main+32&gt;    mov    rax, qword ptr [rbp - 0x10]</span><br><span class="line">   0x40058a &lt;main+36&gt;    sub    rax, 8</span><br><span class="line">   0x40058e &lt;main+40&gt;    mov    qword ptr [rax], 0x41</span><br><span class="line">   0x400595 &lt;main+47&gt;    mov    rax, qword ptr [rbp - 0x10]</span><br><span class="line">   0x400599 &lt;main+51&gt;    mov    rdi, rax</span><br><span class="line">   0x40059c &lt;main+54&gt;    call   free@plt &lt;0x400430&gt;</span><br><span class="line">───────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]───────────────────────────────────────────────────────────────────────</span><br><span class="line">In file: /home/gwt/Desktop/1.c</span><br><span class="line">    3 #include&lt;stdlib.h&gt;</span><br><span class="line">    4 int main()</span><br><span class="line">    5 &#123;</span><br><span class="line">    6     void *p, *q;</span><br><span class="line">    7     p = malloc(0x10);//分配第一个0x10的chunk</span><br><span class="line"> ►  8     malloc(0x10);//分配第二个0x10的chunk</span><br><span class="line">    9     *(long long *)((long long)p - 0x8) = 0x41;// 修改第一个块的size域</span><br><span class="line">   10     free(p);</span><br><span class="line">   11     q = malloc(0x30);// 实现extend，控制了第二个块的内容</span><br><span class="line">   12     return 0;</span><br><span class="line">   13 &#125;</span><br><span class="line">───────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────</span><br><span class="line">00:0000│ rsp  0x7fffffffdea0 —▸ 0x602010 ◂— 0x0</span><br><span class="line">01:0008│      0x7fffffffdea8 ◂— 0x0</span><br><span class="line">02:0010│ rbp  0x7fffffffdeb0 —▸ 0x4005c0 (__libc_csu_init) ◂— push   r15</span><br><span class="line">03:0018│      0x7fffffffdeb8 —▸ 0x7ffff7a2d830 (__libc_start_main+240) ◂— mov    edi, eax</span><br><span class="line">04:0020│      0x7fffffffdec0 ◂— 0x0</span><br><span class="line">05:0028│      0x7fffffffdec8 —▸ 0x7fffffffdf98 —▸ 0x7fffffffe30e ◂— 0x77672f656d6f682f (&#x27;/home/gw&#x27;)</span><br><span class="line">06:0030│      0x7fffffffded0 ◂— 0x100000000</span><br><span class="line">07:0038│      0x7fffffffded8 —▸ 0x400566 (main) ◂— push   rbp</span><br><span class="line">─────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────</span><br><span class="line"> ► f 0           40057c main+22</span><br><span class="line">   f 1     7ffff7a2d830 __libc_start_main+240</span><br><span class="line">pwndbg&gt; vmmap</span><br><span class="line">LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA</span><br><span class="line">          0x400000           0x401000 r-xp     1000 0      /home/gwt/Desktop/a.out</span><br><span class="line">          0x600000           0x601000 r--p     1000 0      /home/gwt/Desktop/a.out</span><br><span class="line">          0x601000           0x602000 rw-p     1000 1000   /home/gwt/Desktop/a.out</span><br><span class="line">          0x602000           0x623000 rw-p    21000 0      [heap]</span><br><span class="line">    0x7ffff7a0d000     0x7ffff7bcd000 r-xp   1c0000 0      /lib/x86_64-linux-gnu/libc-2.23.so</span><br><span class="line">    0x7ffff7bcd000     0x7ffff7dcd000 ---p   200000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so</span><br><span class="line">    0x7ffff7dcd000     0x7ffff7dd1000 r--p     4000 1c0000 /lib/x86_64-linux-gnu/libc-2.23.so</span><br><span class="line">    0x7ffff7dd1000     0x7ffff7dd3000 rw-p     2000 1c4000 /lib/x86_64-linux-gnu/libc-2.23.so</span><br><span class="line">    0x7ffff7dd3000     0x7ffff7dd7000 rw-p     4000 0      </span><br><span class="line">    0x7ffff7dd7000     0x7ffff7dfd000 r-xp    26000 0      /lib/x86_64-linux-gnu/ld-2.23.so</span><br><span class="line">    0x7ffff7fdc000     0x7ffff7fdf000 rw-p     3000 0      </span><br><span class="line">    0x7ffff7ff7000     0x7ffff7ffa000 r--p     3000 0      [vvar]</span><br><span class="line">    0x7ffff7ffa000     0x7ffff7ffc000 r-xp     2000 0      [vdso]</span><br><span class="line">    0x7ffff7ffc000     0x7ffff7ffd000 r--p     1000 25000  /lib/x86_64-linux-gnu/ld-2.23.so</span><br><span class="line">    0x7ffff7ffd000     0x7ffff7ffe000 rw-p     1000 26000  /lib/x86_64-linux-gnu/ld-2.23.so</span><br><span class="line">    0x7ffff7ffe000     0x7ffff7fff000 rw-p     1000 0      </span><br><span class="line">    0x7ffffffde000     0x7ffffffff000 rw-p    21000 0      [stack]</span><br><span class="line">0xffffffffff600000 0xffffffffff601000 r-xp     1000 0      [vsyscall]</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; info locals </span><br><span class="line">p = 0x602010</span><br><span class="line">q = 0x0</span><br><span class="line">pwndbg&gt; x/10gx 0x602020</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000021 &lt;=chunk1</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000020fc1 &lt;=top chunk</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>info local可以查看指针指向的地址，即user_data的起始地址</p>
<p>继续执行</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32gx 0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000021 &lt;=chunk1</span><br><span class="line">0x602010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000021 &lt;=chunk2</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000020fc1 &lt;=top chunk</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">pwndbg&gt; heap</span><br><span class="line">0x602000 FASTBIN &#123;</span><br><span class="line">  prev_size = 0, </span><br><span class="line">  size = 33, </span><br><span class="line">  fd = 0x0, </span><br><span class="line">  bk = 0x0, </span><br><span class="line">  fd_nextsize = 0x0, </span><br><span class="line">  bk_nextsize = 0x21</span><br><span class="line">&#125;</span><br><span class="line">0x602020 FASTBIN &#123;</span><br><span class="line">  prev_size = 0, </span><br><span class="line">  size = 33, </span><br><span class="line">  fd = 0x0, </span><br><span class="line">  bk = 0x0, </span><br><span class="line">  fd_nextsize = 0x0, </span><br><span class="line">  bk_nextsize = 0x20fc1</span><br><span class="line">&#125;</span><br><span class="line">0x602040 PREV_INUSE &#123;</span><br><span class="line">  prev_size = 0, </span><br><span class="line">  size = 135105, </span><br><span class="line">  fd = 0x0, </span><br><span class="line">  bk = 0x0, </span><br><span class="line">  fd_nextsize = 0x0, </span><br><span class="line">  bk_nextsize = 0x0</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>size &#x3D; 33 &#x3D; 0x21 &#x3D; 0x8(prev_size) + 0x8(size) + 0x1(内容) + 0x1(标志位)</p>
<p>继续执行：<code>*(long long *)((long long)p - 0x8) = 0x41</code>后</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32gx 0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000041</span><br><span class="line">0x602010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000021</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000020fc1</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>可以看到chunk1的size 已经变为了0x41，也就是说chunk1的现在大小包含了原来的chunk1和chunk2的大小。</p>
<p>继续执行：free后</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32gx 0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000041</span><br><span class="line">0x602010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000021</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000020fc1</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">pwndbg&gt; bin</span><br><span class="line">fastbins</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x40: 0x602000 ◂— 0x0</span><br><span class="line">0x50: 0x0</span><br><span class="line">0x60: 0x0</span><br><span class="line">0x70: 0x0</span><br><span class="line">0x80: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x0</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br><span class="line">pwndbg&gt; info locals </span><br><span class="line">p = 0x602010</span><br><span class="line">q = 0x0</span><br></pre></td></tr></table></figure>

<p>这里虽然free了chunk1，但是内容并没有清空。</p>
<p>之后将chunk1（也就是合并之后的）放进了fastbin中。</p>
<p>继续执行：malloc</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32gx 0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000041</span><br><span class="line">0x602010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000021</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000020fc1</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">pwndbg&gt; info bin</span><br><span class="line">Undefined info command: &quot;bin&quot;.  Try &quot;help info&quot;.</span><br><span class="line">pwndbg&gt; bins</span><br><span class="line">fastbins</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">0x50: 0x0</span><br><span class="line">0x60: 0x0</span><br><span class="line">0x70: 0x0</span><br><span class="line">0x80: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x0</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br><span class="line">pwndbg&gt; info locals </span><br><span class="line">p = 0x602010</span><br><span class="line">q = 0x602010</span><br></pre></td></tr></table></figure>

<p>malloc后的空间给了q，这样就可以通过新分配的chunk来对chunk2中的内容进行操作了，将这种状态称为overlapping chunk。</p>
<h3 id="示例2：对inuse的smallbin进行extend"><a href="#示例2：对inuse的smallbin进行extend" class="headerlink" title="示例2：对inuse的smallbin进行extend"></a>示例2：对inuse的smallbin进行extend</h3><p>示例代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">void</span> *p, *q;</span><br><span class="line">    p = <span class="built_in">malloc</span>(<span class="number">0x80</span>);<span class="comment">//分配第一个 0x80 的chunk1</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>); <span class="comment">//分配第二个 0x10 的chunk2</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>); <span class="comment">//防止与top chunk合并</span></span><br><span class="line">    *(<span class="keyword">long</span> *)((<span class="keyword">long</span>)p<span class="number">-0x8</span>) = <span class="number">0xb1</span>;</span><br><span class="line">    <span class="built_in">free</span>(p);</span><br><span class="line">    q = <span class="built_in">malloc</span>(<span class="number">0xa0</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; r</span><br><span class="line">Starting program: /home/gwt/Desktop/a.out </span><br><span class="line"></span><br><span class="line">Breakpoint 1, main () at 1.c:9</span><br><span class="line">9	    *(long *)((long)p-0x8) = 0xb1;</span><br><span class="line">LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA</span><br><span class="line">─────────────────────────────────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────────────────────────────────</span><br><span class="line"> RAX  0x6020c0 ◂— 0x0</span><br><span class="line"> RBX  0x0</span><br><span class="line"> RCX  0x7ffff7dd1b20 (main_arena) ◂— 0x100000000</span><br><span class="line"> RDX  0x6020c0 ◂— 0x0</span><br><span class="line"> RDI  0x0</span><br><span class="line"> RSI  0x6020d0 ◂— 0x0</span><br><span class="line"> R8   0x602000 ◂— 0x0</span><br><span class="line"> R9   0xd</span><br><span class="line"> R10  0x7ffff7dd1b78 (main_arena+88) —▸ 0x6020d0 ◂— 0x0</span><br><span class="line"> R11  0x0</span><br><span class="line"> R12  0x400470 (_start) ◂— xor    ebp, ebp</span><br><span class="line"> R13  0x7fffffffdf90 ◂— 0x1</span><br><span class="line"> R14  0x0</span><br><span class="line"> R15  0x0</span><br><span class="line"> RBP  0x7fffffffdeb0 —▸ 0x4005c0 (__libc_csu_init) ◂— push   r15</span><br><span class="line"> RSP  0x7fffffffdea0 —▸ 0x602010 ◂— 0x0</span><br><span class="line"> RIP  0x400590 (main+42) ◂— mov    rax, qword ptr [rbp - 0x10]</span><br><span class="line">──────────────────────────────────────────────────────────────────────────[ DISASM ]───────────────────────────────────────────────────────────────────────────</span><br><span class="line"> ► 0x400590 &lt;main+42&gt;    mov    rax, qword ptr [rbp - 0x10]</span><br><span class="line">   0x400594 &lt;main+46&gt;    sub    rax, 8</span><br><span class="line">   0x400598 &lt;main+50&gt;    mov    qword ptr [rax], 0xb1</span><br><span class="line">   0x40059f &lt;main+57&gt;    mov    rax, qword ptr [rbp - 0x10]</span><br><span class="line">   0x4005a3 &lt;main+61&gt;    mov    rdi, rax</span><br><span class="line">   0x4005a6 &lt;main+64&gt;    call   free@plt &lt;0x400430&gt;</span><br><span class="line"> </span><br><span class="line">   0x4005ab &lt;main+69&gt;    mov    edi, 0xa0</span><br><span class="line">   0x4005b0 &lt;main+74&gt;    call   malloc@plt &lt;0x400450&gt;</span><br><span class="line"> </span><br><span class="line">   0x4005b5 &lt;main+79&gt;    mov    qword ptr [rbp - 8], rax</span><br><span class="line">   0x4005b9 &lt;main+83&gt;    mov    eax, 0</span><br><span class="line">   0x4005be &lt;main+88&gt;    leave  </span><br><span class="line">───────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]───────────────────────────────────────────────────────────────────────</span><br><span class="line">In file: /home/gwt/Desktop/1.c</span><br><span class="line">    4 &#123;</span><br><span class="line">    5     void *p, *q;</span><br><span class="line">    6     p = malloc(0x80);//分配第一个 0x80 的chunk1</span><br><span class="line">    7     malloc(0x10); //分配第二个 0x10 的chunk2</span><br><span class="line">    8     malloc(0x10); //防止与top chunk合并</span><br><span class="line"> ►  9     *(long *)((long)p-0x8) = 0xb1;</span><br><span class="line">   10     free(p);</span><br><span class="line">   11     q = malloc(0xa0);</span><br><span class="line">   12 &#125;</span><br><span class="line">───────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────</span><br><span class="line">00:0000│ rsp  0x7fffffffdea0 —▸ 0x602010 ◂— 0x0</span><br><span class="line">01:0008│      0x7fffffffdea8 ◂— 0x0</span><br><span class="line">02:0010│ rbp  0x7fffffffdeb0 —▸ 0x4005c0 (__libc_csu_init) ◂— push   r15</span><br><span class="line">03:0018│      0x7fffffffdeb8 —▸ 0x7ffff7a2d830 (__libc_start_main+240) ◂— mov    edi, eax</span><br><span class="line">04:0020│      0x7fffffffdec0 ◂— 0x0</span><br><span class="line">05:0028│      0x7fffffffdec8 —▸ 0x7fffffffdf98 —▸ 0x7fffffffe30e ◂— 0x77672f656d6f682f (&#x27;/home/gw&#x27;)</span><br><span class="line">06:0030│      0x7fffffffded0 ◂— 0x100000000</span><br><span class="line">07:0038│      0x7fffffffded8 —▸ 0x400566 (main) ◂— push   rbp</span><br><span class="line">─────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────</span><br><span class="line"> ► f 0           400590 main+42</span><br><span class="line">   f 1     7ffff7a2d830 __libc_start_main+240</span><br><span class="line">Breakpoint /home/gwt/Desktop/1.c:9</span><br><span class="line">pwndbg&gt; x/50gx 0x602000 </span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000091 &lt;=chunk1</span><br><span class="line">0x602010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000 &lt;=chunk1_end</span><br><span class="line">0x602090:	0x0000000000000000	0x0000000000000021 &lt;=chunk2</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000000021 &lt;=chunk3</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000020f31 &lt;=top_chunk</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602130:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602140:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602150:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602160:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602170:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602180:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>继续执行后和上一个示例一样，chunk1的大小变为了原来的chunk1+chunk2。</p>
<p>执行free：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/50gx 0x602000 </span><br><span class="line">0x602000:	0x0000000000000000	0x00000000000000b1</span><br><span class="line">0x602010:	0x00007ffff7dd1b78	0x00007ffff7dd1b78</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000000	0x0000000000000021</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x00000000000000b0	0x0000000000000020</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000020f31</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602130:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602140:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602150:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602160:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602170:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602180:	0x0000000000000000	0x0000000000000000</span><br><span class="line">pwndbg&gt; bin</span><br><span class="line">fastbins</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">0x50: 0x0</span><br><span class="line">0x60: 0x0</span><br><span class="line">0x70: 0x0</span><br><span class="line">0x80: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x602000 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x602000</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br></pre></td></tr></table></figure>

<p>可以看到chunk3 的size变为了0x20。free后的chunk1进入了unsortedbin，有两种情况下进入unsortedbin：</p>
<ul>
<li>当一个较大的chunk被分割为两部分后，如果剩下的部分大于minsize，就会放入unsortedbin中。</li>
<li>释放一个不属于fastbin的chunk，并且这个chunk不和top chunk紧邻时，这个chunk就会授信啊被放到unsortedbin中。</li>
</ul>
<p>这个例子就是上面的第二种情况，不属于fastbin，且不和top chunk紧邻。同样，之后的malloc后也可以达到对chunk2进行操作的目的。</p>
<h3 id="示例3：对-free-的-smallbin-进行-extend"><a href="#示例3：对-free-的-smallbin-进行-extend" class="headerlink" title="示例3：对 free 的 smallbin 进行 extend"></a>示例3：对 free 的 smallbin 进行 extend</h3><p>示例代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">void</span> *p, *q;</span><br><span class="line">    p = <span class="built_in">malloc</span>(<span class="number">0x80</span>);<span class="comment">//分配第一个0x80的chunk1</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>);<span class="comment">//分配第二个0x10的chunk2</span></span><br><span class="line">    <span class="built_in">free</span>(p);<span class="comment">//首先进行释放，使得chunk1进入unsorted bin</span></span><br><span class="line">    *(<span class="keyword">long</span> *)((<span class="keyword">long</span>)p - <span class="number">0x8</span>) = <span class="number">0xb1</span>;</span><br><span class="line">    q = <span class="built_in">malloc</span>(<span class="number">0xa0</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>执行free后：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; bin</span><br><span class="line">fastbins</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">0x50: 0x0</span><br><span class="line">0x60: 0x0</span><br><span class="line">0x70: 0x0</span><br><span class="line">0x80: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x602000 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x602000</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br><span class="line">pwndbg&gt; x/40gx  0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000091</span><br><span class="line">0x602010:	0x00007ffff7dd1b78	0x00007ffff7dd1b78</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000090	0x0000000000000020</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000020f51</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602130:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>接下来执行：<code>*(long *)((long)p - 0x8) = 0xb1;</code></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/40gx  0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x00000000000000b1</span><br><span class="line">0x602010:	0x00007ffff7dd1b78	0x00007ffff7dd1b78</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000090	0x0000000000000020</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000020f51</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602130:	0x0000000000000000	0x0000000000000000</span><br><span class="line">pwndbg&gt; bins</span><br><span class="line">fastbins</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">0x50: 0x0</span><br><span class="line">0x60: 0x0</span><br><span class="line">0x70: 0x0</span><br><span class="line">0x80: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x602000 —▸ 0x7ffff7dd1b78 (main_arena+88) ◂— 0x602000</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br></pre></td></tr></table></figure>

<p>继续malloc：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; bins</span><br><span class="line">fastbins</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">0x50: 0x0</span><br><span class="line">0x60: 0x0</span><br><span class="line">0x70: 0x0</span><br><span class="line">0x80: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x0</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br><span class="line">pwndbg&gt; info locals </span><br><span class="line">p = 0x602010</span><br><span class="line">q = 0x602010</span><br></pre></td></tr></table></figure>

<p>依然可以达到对chunk2进行控制。</p>
<h3 id="示例4：通过extend后向overlapping"><a href="#示例4：通过extend后向overlapping" class="headerlink" title="示例4：通过extend后向overlapping"></a>示例4：通过extend后向overlapping</h3><p>示例代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">void</span> *p, *q;</span><br><span class="line">    p = <span class="built_in">malloc</span>(<span class="number">0x10</span>);<span class="comment">//分配第1个 0x10 的chunk1</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>); <span class="comment">//分配第2个 0x10 的chunk2</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>); <span class="comment">//分配第3个 0x10 的chunk3</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>); <span class="comment">//分配第4个 0x10 的chunk4    </span></span><br><span class="line">    *(<span class="keyword">long</span> *)((<span class="keyword">long</span>)p - <span class="number">0x8</span>) = <span class="number">0x61</span>;</span><br><span class="line">    <span class="built_in">free</span>(p);</span><br><span class="line">    q = <span class="built_in">malloc</span>(<span class="number">0x50</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>free：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; bin</span><br><span class="line">fastbins</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">0x50: 0x0</span><br><span class="line">0x60: 0x602000 ◂— 0x0</span><br><span class="line">0x70: 0x0</span><br><span class="line">0x80: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x0</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br></pre></td></tr></table></figure>

<p>在 malloc(0x50) 后，其中 0x10 的 fastbin 块依然可以正常的分配和释放，此时已经构成 overlapping，通过对 overlapping 的进行操作可以实现 fastbin attack</p>
<h3 id="示例5：通过-extend-前向-overlapping"><a href="#示例5：通过-extend-前向-overlapping" class="headerlink" title="示例5：通过 extend 前向 overlapping"></a>示例5：通过 extend 前向 overlapping</h3><p>这里展示通过修改 pre_inuse 域和 pre_size 域实现合并前面的块。</p>
<p>示例代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span><span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">(<span class="keyword">void</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="keyword">void</span> *p, *q, *r, *t;</span><br><span class="line">    p = <span class="built_in">malloc</span>(<span class="number">128</span>);<span class="comment">//smallbin1</span></span><br><span class="line">    q = <span class="built_in">malloc</span>(<span class="number">0x10</span>);<span class="comment">//fastbin1</span></span><br><span class="line">    r = <span class="built_in">malloc</span>(<span class="number">0x10</span>);<span class="comment">//fastbin2</span></span><br><span class="line">    t = <span class="built_in">malloc</span>(<span class="number">128</span>);<span class="comment">//smallbin2</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x10</span>);<span class="comment">//防止与top合并</span></span><br><span class="line">    <span class="built_in">free</span>(p);</span><br><span class="line">    *(<span class="keyword">int</span> *)((<span class="keyword">long</span> <span class="keyword">long</span>)t - <span class="number">0x8</span>) = <span class="number">0x90</span>;<span class="comment">//修改prev_inuse域</span></span><br><span class="line">    *(<span class="keyword">int</span> *)((<span class="keyword">long</span> <span class="keyword">long</span>)t - <span class="number">0x10</span>) = <span class="number">0xd0</span>;<span class="comment">//修改prev_size域</span></span><br><span class="line">    <span class="built_in">free</span>(t);<span class="comment">//unlink进行前向extend</span></span><br><span class="line">    <span class="built_in">malloc</span>(<span class="number">0x150</span>);<span class="comment">//占位块</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>前面的几个malloc后：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/80gx 0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000091 &lt;=chunk1</span><br><span class="line">0x602010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000 &lt;=chunk1_end</span><br><span class="line">0x602090:	0x0000000000000000	0x0000000000000021 &lt;=chunk2</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000000021 &lt;=chunk3</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x0000000000000000	0x0000000000000091 &lt;=chunk4</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602130:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602140:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602150:	0x0000000000000000	0x0000000000000000 &lt;=chunk4_end</span><br><span class="line">0x602160:	0x0000000000000000	0x0000000000000021</span><br><span class="line">0x602170:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602180:	0x0000000000000000	0x0000000000020e81</span><br><span class="line">0x602190:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021d0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602200:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602210:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602220:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602230:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602240:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602250:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602260:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602270:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>修改prev_inuse域和prev_size后：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/60gx 0x602000</span><br><span class="line">0x602000:	0x0000000000000000	0x0000000000000091</span><br><span class="line">0x602010:	0x00007ffff7dd1b78	0x00007ffff7dd1b78</span><br><span class="line">0x602020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602040:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602060:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602090:	0x0000000000000090	0x0000000000000020</span><br><span class="line">0x6020a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020b0:	0x0000000000000000	0x0000000000000021</span><br><span class="line">0x6020c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020d0:	0x00000000000000d0	0x0000000000000090</span><br><span class="line">0x6020e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6020f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602130:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602140:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602150:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602160:	0x0000000000000000	0x0000000000000021</span><br><span class="line">0x602170:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x602180:	0x0000000000000000	0x0000000000020e81</span><br><span class="line">0x602190:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x6021d0:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>注意0x602097和0x6020d7。此时chunk1为之前malloc的4个大小之和。</p>
<p>通过修改prev_size域和prev_inuse域可以跨越多个chunk进行合并。</p>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/03/21/%E5%A0%86%E4%B8%AD%E7%9A%84off-by-one/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-03-22
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/03/23/pwndbg%E5%92%8CLinux%E6%94%B9%E7%94%A8%E6%88%B7%E5%90%8D%E5%8F%8A%E5%AF%86%E7%A0%81%E8%B8%A9%E5%9D%91/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#Chunk-Extend-and-Overlapping"><span class="toc-text">Chunk Extend and Overlapping</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%BB%8B%E7%BB%8D"><span class="toc-text">介绍</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%8E%9F%E7%90%86"><span class="toc-text">原理</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%9F%BA%E6%9C%AC%E7%A4%BA%E4%BE%8B"><span class="toc-text">基本示例</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B1%EF%BC%9A%E5%AF%B9inuse%E7%9A%84fastbin%E8%BF%9B%E8%A1%8Cextend"><span class="toc-text">示例1：对inuse的fastbin进行extend</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B2%EF%BC%9A%E5%AF%B9inuse%E7%9A%84smallbin%E8%BF%9B%E8%A1%8Cextend"><span class="toc-text">示例2：对inuse的smallbin进行extend</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B3%EF%BC%9A%E5%AF%B9-free-%E7%9A%84-smallbin-%E8%BF%9B%E8%A1%8C-extend"><span class="toc-text">示例3：对 free 的 smallbin 进行 extend</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B4%EF%BC%9A%E9%80%9A%E8%BF%87extend%E5%90%8E%E5%90%91overlapping"><span class="toc-text">示例4：通过extend后向overlapping</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A4%BA%E4%BE%8B5%EF%BC%9A%E9%80%9A%E8%BF%87-extend-%E5%89%8D%E5%90%91-overlapping"><span class="toc-text">示例5：通过 extend 前向 overlapping</span></a></li></ol></li></ol></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + Chunk%20Extend%20and%20Overlapping + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F03%2F22%2Fchunk-extend-and-overlapping%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/03/22/chunk-extend-and-overlapping/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
